# Standards and Regulatory References

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 77** — Right to lodge a complaint with a supervisory authority
- **Article 78** — Right to an effective judicial remedy against a supervisory authority
- **Article 31** — Cooperation with the supervisory authority
- **Article 58** — Powers of supervisory authorities (investigative, corrective, advisory)
- **Article 83** — General conditions for imposing administrative fines
- **Article 56** — Competence of the lead supervisory authority (one-stop-shop mechanism)
- **Recital 141** — Right to lodge a complaint: every data subject should have the right to lodge a complaint with a single supervisory authority

### UK Data Protection Act 2018
- **Section 142** — Assessment notices: ICO power to require controllers to provide information
- **Section 146** — Enforcement notices
- **Section 149-150** — Penalty notices and amount of penalties
- **Section 165** — Complaints by data subjects to the Commissioner

## Regulatory Guidance

### Information Commissioner's Office (ICO) — United Kingdom
- **Regulatory action policy** (updated 2024): Framework for how the ICO decides on regulatory action, including factors considered when assessing complaints and determining outcomes.
- **Data protection complaints guidance**: Guidance on how the ICO handles complaints from data subjects.

### European Data Protection Board (EDPB)
- **Guidelines 02/2022 on the application of Article 60 GDPR** (adopted 14 March 2023): Cooperation and consistency mechanism, relevant to cross-border complaint handling.
- **Guidelines on the application and setting of administrative fines (WP253)** (adopted 3 October 2017): Framework for how supervisory authorities calculate fines, relevant to assessing complaint risk.

## Technical Standards

### ISO/IEC 27701:2019 — Privacy Information Management
- **Section 6.15.1** — Compliance with legal and contractual requirements: establishes controls for managing regulatory engagement within a PIMS.